What is the CVSS score of CVE-2025-50493?

CVE-2025-50493 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Doctor Appointment System are affected by CVE-2025-50493?

PHPGurukul Doctor Appointment Management System v1.0.0 is vulnerable to session hijacking; publicly available exploit code exists for this vulnerability.

How to fix or mitigate CVE-2025-50493?

Within 24 hours: Identify and catalog all instances of PHPGurukul Doctor Appointment Management System v1.0.0 across infrastructure and assess network accessibility. Within 7 days: Implement emergency session invalidation for all active doctor sessions upon password change (via application code or WAF rule), and enable comprehensive session activity logging. Within 30 days: Contact vendor for patch timeline; if no patch is released, evaluate upgrade to alternative appointment management system with secure session controls or implement application-level session security hardening.

Doctor Appointment System CVE-2025-50493

HIGH

Improper Input Validation (CWE-20)

2025-07-28 cve@mitre.org

Information Disclosure PHP Doctor Appointment Management System

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.4 HIGH

Attacker must first obtain a valid session token (AC:H); success yields full account access so C:H/I:H, with no availability impact (A:N), correcting the published A:H-only vector.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 01:47 vuln.today

DescriptionCVE.org

Improper session invalidation in the component /doctor/change-password.php of PHPGurukul Doctor Appointment Management System v1 allows attackers to execute a session hijacking attack.

AnalysisAI

Session hijacking in PHPGurukul Doctor Appointment Management System v1.0.0 stems from improper session invalidation in /doctor/change-password.php, where doctor account sessions are not terminated after a password change. A publicly available exploit code exists (GitHub, VasilVK), but there is no public exploit identified as actively exploited and it is not in CISA KEV. EPSS is low at 0.41% (33rd percentile), indicating limited real-world exploitation interest to date.

Technical ContextAI

The affected component is a PHP-based web application from PHPGurukul, a vendor of free/low-cost educational PHP+MySQL project templates. The root cause maps loosely to CWE-20 (Improper Input Validation) in the NVD record, but the described behavior - sessions remaining valid across a password change - is more precisely a session-management weakness (in the family of CWE-613 Insufficient Session Expiration / CWE-384 Session Fixation). In practice, change-password.php updates credentials without regenerating or invalidating existing PHP session identifiers, so a previously established session (or a captured PHPSESSID) continues to authenticate the doctor account even after the legitimate user rotates the password. CPE cpe:2.3:a:phpgurukul:doctor_appointment_management_system:1.0.0 identifies the exact affected build.

RemediationAI

No vendor-released patch identified at time of analysis; PHPGurukul has not published a fixed version for this issue. As specific compensating controls, modify /doctor/change-password.php to call session_regenerate_id(true) and destroy all prior server-side sessions immediately upon a successful password change, forcing re-authentication of every existing session (trade-off: the doctor is logged out of other devices). Enforce short session lifetimes and idle timeouts in the PHP session configuration to shrink the window a stale token remains usable, and set session cookies with HttpOnly, Secure, and SameSite attributes plus HTTPS-only transport to reduce the chance of token capture in the first place. Restrict network access to the /doctor/ administrative area (IP allow-listing or VPN) since this is a small-clinic application not intended for broad internet exposure. Consult the PoC at https://github.com/VasilVK/CVE/tree/main/CVE-2025-50493 to validate that your fix closes the exact path.